1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
##
# This file is part of WhatWeb and may be subject to
# redistribution and commercial restrictions. Please see the WhatWeb
# web site for more information on licensing and terms of use.
# http://www.morningstarsecurity.com/research/whatweb
##
Plugin.define "Plugin-Template" do
author "Enter Your Name"
version "0.1"
description "Describe what the plugin identifies. Include the homepage of the software package. Copy this to a new file eg. plugin-name.rb"
examples %w| include-some.net example-websites.com here.com |
# a comment block here is a good place to make notes for yourself and others
# These are the types of matches:
# :regexp -- it's a regular expression in ruby, eg. /^foobar$/
# :text -- case sensitive text
# :ghdb -- Google Hack Database. u can use intitle: inurl: -
# :md5 -- MD5 hash of the body
# :tagpattern -- a pattern made by the html entities. fuzzy matching coming soon
# :url -- you can combine this with other variables or use by itself
# :name -- naming the matches is optional
# :search -- can be "body" (default), "all", "headers", or "headers[x]" for a specific HTTP header
# :account -- this is used to return data
# :version -- this is used to return data
# :os -- this is used to return data
# :module -- this is used to return data
# :model -- this is used to return data
# :string -- this is used to return data
# :firmware -- this is used to return data
# :filepath -- this is used to return data
# Matches are enclosed in {} brackets and separated by commas
matches [
{:name=>"a brief description of the match, eg. powered by in footer",
:regexp=>/This page was generated by <a href="http:\/\/www.genericcms.com\/en\/products\/generic-cms\/">Generic CMS<\/a>/ },
{:name=>"title",
:certainty=>75,
:text=>"<title>Generic Homepage</title>" }, # note the comma
{:url=>'/admin/login.php', :text=>'StarCraft Login Panel' },
{:ghdb=>'intitle:"Foobar" -Fooboo Access', :certainty=>25 },
# :certainty => 100 is certain (default), 75 is probably and 25 is maybe
{:url=>"/wp-login.php",
:tagpattern=>"!DOCTYPE,html,head,title,/title,meta,link,link,script,/script,meta,/head,body,div,h1,a,/a,/h1,form,p,label,br,input,/label,/p,p,label,br,input,/label,/p,p,label,input,/label,/p,p,input,input,input,/p,/form,p,a,/a,/p,p,a,/a,/p,/div,script,/script,/body,/html"},
# tags are delimited by commas. fuzzy matching is coming in the future
{:url=>"favicon.ico", :md5=>'f420dc2c7d90d7873a90d82cd7fde315'} # not common, seen on http://s.wordpress.org/favicon.ico
]
# this always runs
def passive
# make a matches array
m=[]
# you should learn by example :)
# want some debugging? maybe you'd like to view some variables
=begin
@body
@headers
@cookies
@status
@base_uri
@md5sum
@tagpattern
@ip
=end
pp @headers
pp @status
pp @body
puts @base_uri.to_s
# return the matches array, even if it's emtpy
m
end
# this runs :
# at aggressive level 3 if passive matches
# at aggressive level 4
def aggressive
# make a matches array. this returns the equivalent of the matches[] block above
m=[]
# return the matches array, even if it's emtpy
m
end
# this runs when the plugin is first loaded
def startup
end
# this runs when the plugin is closed on whatweb shutdown
def shutdown
end
end
|
